Security update: The recent PHP vulnerabilities don’t affect us. None of our products or infrastructure use PHP. We’ve also reviewed our app after the recent Shopify checkout phishing attack and ran Shopify’s new security check. No issues were found.
Free template
A checklist a merchant ticks before a sale: what the banner must do before the choice, on the first layer, in the notice and afterwards, plus the Shopify settings. Built from Article 5(3) of the ePrivacy Directive, GDPR Articles 4(11) and 7, the Planet49 judgment and the national guidelines.
Who needs it
Every store with visitors in the EU that sets any cookie or similar storage beyond what the service the visitor asked for strictly needs. Article 5(3) of Directive 2002/58/EC allows such storage, or access to it, after the user has given consent on the basis of clear and comprehensive information; the GDPR defines that consent as freely given, specific, informed and unambiguous, by a clear affirmative action (Article 4(11)), withdrawable as easily as it was given (Article 7(3)). The cookie consent rules guide explains the law and the national positions; this page turns them into checks.
Copy it into your notes or a ticket and tick each point for the live store. The first line names the rules the checks come from; the last group holds the points that apply in one country.
Cookie banner checklist
COOKIE BANNER CHECKLIST (EU, ePrivacy Article 5(3) and GDPR Articles 4(11) and 7) Store: [store name] Checked by: [name] Date: [date] Before the choice [ ] No cookie or similar storage that is not strictly necessary is set or read before the visitor chooses. [ ] Strictly necessary storage (cart, login, checkout, the consent record itself) is not in the banner and is listed in the cookie notice. [ ] Analytics and marketing pixels, including Shopify Pixels and pixels added by apps or a tag manager, wait for consent. The first layer [ ] Accept and reject are both on the first layer, and refusing takes no more clicks than accepting (CNIL fines of 6 January 2022; AEPD guide). [ ] No pre-ticked boxes; no consent by scrolling, by continuing to browse or by closing the banner. [ ] The site stays usable after a refusal (no cookie wall), unless an equivalent access without consent is offered. [ ] The purposes are named in plain language before the choice (for example analytics, advertising, personalisation). The information [ ] The cookie notice lists each cookie or purpose group, its lifetime and the third parties that can read it. [ ] Consent is specific: separate choices at least by purpose; one choice does not cover unrelated purposes. [ ] The notice is in the language of each market you sell to. Afterwards [ ] Withdrawal is as easy as consent: a footer link reopens the banner at any time (GDPR Article 7(3)). [ ] Each choice is recorded with its date, the version of the banner and what was chosen, so consent can be proven. [ ] The visitor is not asked again for a reasonable period after a choice (Italy: no re-prompt for six months after a refusal). Shopify settings [ ] Settings > Customer privacy: data collection set to "collected after consent" for every EU market and the UK. [ ] If a consent app replaces the built-in banner, its regions match the Customer privacy regions. [ ] Every pixel installed by hand or by an app has been checked against the Customer Privacy API consent flags. [ ] The cookie notice link and the privacy policy link are in the footer on every page. Markets with extra rules (check the one you sell to) [ ] France (CNIL guidelines, 4 July 2019): no consent by scrolling; nothing read or written before consent; the service stays accessible on refusal; consent provable and easy to withdraw. [ ] Germany (§ 25 TDDDG): storage or access needs consent after clear and comprehensive information, GDPR standard; exempt where strictly necessary for the service the user asked for. [ ] Italy (Garante guidelines, 10 June 2021): closing the banner with the X means no non-technical cookies; no re-prompt for six months; cookie walls unlawful save for an equivalent service without consent. [ ] Spain (Article 22.2 LSSI; AEPD cookie guide, May 2024): a reject option in the first layer; granular accept or reject at least by purpose. [ ] Austria (§ 165(3) TKG 2021): active consent after clear and comprehensive information; the legal basis, purposes and storage period stated.
Storage needed to transmit a communication, or strictly necessary to provide a service the user explicitly asked for (Article 5(3) of Directive 2002/58/EC). The usual examples are the cart, the login session, the checkout and the record of the consent choice itself. Analytics and marketing pixels are not strictly necessary and fire only after consent.
No. In Planet49 (C-673/17, 1 October 2019) the Court of Justice ruled that consent given by a pre-ticked checkbox the user must deselect is not valid, and GDPR Article 4(11) requires a clear affirmative action. National regulators (the CNIL, the Garante) say the same about scrolling.
Yes. Shopify's Customer privacy settings collect non-essential data only after consent in the regions you configure, the UK and the EEA by default, and the built-in banner governs Shopify's own tools, including Shopify Pixels. A consent app can replace it as long as the regions match, and pixels added by hand or by apps may need the consent app or custom logic that reads the Customer Privacy API.
No. Complimus covers four EU rules: the Omnibus prior price, the GPSR product safety details and the EU legal guarantee notice on the product page, and the withdrawal button with its confirmation emails. For the cookie banner use the built-in Shopify banner or a consent app; our comparison pages show what each covers.
Complimus helps you apply these rules. It is not legal advice, and you remain the trader responsible for what your storefront shows. The template is a starting point for your own text, not a legal document checked for your store.
